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This paper discusses the design and application of model-based engine control (MBEC) for 
use during emergency operation of the aircraft. The MBEC methodology is applied to the 
Commercial Modular Aero -Propulsion System Simulation 40k (CMAPSS40k) and features 
an optimal tuner Kalman Filter (OTKF) to estimate unmeasured engine parameters, which 
can then be used for control. During an emergency scenario, normally-conservative engine 
operating limits may be relaxed to increase the performance of the engine and overall 
survivability of the aircraft; this comes at the cost of additional risk of an engine failure. The 
MBEC architecture offers the advantage of estimating key engine parameters that are not 
directly measureable. Estimating the unknown parameters allows for tighter control over 
these parameters, and on the level of risk the engine will operate at. This will allow the engine 
to achieve better performance than possible when operating to more conservative limits on a 
related, measurable parameter. 


Nomenclature 


CMAPSS40k 

Commercial Modular Aero-Propulsion System Simulation 40k 

EEC 

Enhanced engine controller 

EPR 

Engine Pressure Ratio 

Fnet 

Thrust, Ibf 

HPC 

High pressure compressor 

HPCSM 

High pressure compressor surge margin, % 

IWP 

Integral wind-up protection 

LPC 

Low pressure compressor 

LPT 

Low pressure turbine 

MBEC 

Model based engine control 

Nc 

Core speed, rpm 

Nf 

Fan speed, rpm 

OTKF 

Optimal tuner Kalman filter 

Pa 

Ambient pressure, psi 

PC 

Power code, % 

PI 

Proportional integral controller 

PLA 

Power lever angle, degrees 

PRhpc 

Pressure ratio across high pressure compressor 

P2 

Inlet pressure, psi 

P25 

Low pressure compressor exit pressure, psi 

Ps3 

Combustor static pressure, psi 

P50 

Low pressure turbine exit temperature, degrees Rankin 

RamP 

Ram pressure 

SLS 

Sea level static 

T25 

Low pressure compressor exit temperature, degrees Rankin 

T30 

High pressure compressor exit temperature, degrees Rankin 

T40 

High pressure turbine inlet temperature, degrees Rankin 
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T48 High pressure turbine exit temperature, degrees Rankin 

T50 Low pressure turbine exit temperature, degrees Rankin 

VBV V ariable bleed valve 

VSV Variable stator vane, degrees 

Wf Fuel flow rate, Ib/s 

Whpc High pressure compressor flow, Ib/s 

A uwf Change in fuel flow, Ib/s 

I. Introduction 

T HE National Aeronautics and Space Administration Aeronautics Research Mission Directorate is focused on 
providing solutions to improve aviation safety and reduce the environmental impacts of air transportation, 
amongst other objectives. Specifically of interest, in relation to aviation safety, is the ability to use an aircraft’s engines 
to help pilots avert or recover from emergency situations. 1 The focus is on two general types of emergency scenarios: 
1) runway incursion, and 2) rudder/tail failures. These emergency scenarios are derived from events of actual in-flight 
airframe malfunction or damage, where flight crews resorted to engine throttle modulation to maintain aircraft 
control. 2,3 The runway incursion scenario focuses on situations where an aircraft’s available takeoff distance is 
suddenly decreased. In this event, the availability of additional contingency thrust may enable safe takeoff in a 
shortened distance by allowing the aircraft to reach its safe takeoff speed sooner, thus avoiding the disaster. To provide 
this additional thrust, a control mode referred to as overthrust has been previously proposed. 1 

The rudder/tail failure scenario encompasses cases where problems with the flight control surfaces are 
encountered, such as stuck or broken actuators, airframe damage, and damaged or missing controls surfaces. Studies 
have shown that, although it is possible to land an aircraft using only the throttles to maneuver the aircraft, this is an 
extremely difficult task due to the slow engine response times and the inability to damp out phugoid and dutch roll 
modes. 4,5 In this situation, increasing the responsiveness of the engines in order to counter these modes is the primary 
goal; this is done through the faster engine response control mode. One approach that has been developed for 
designing a fast engine response controller involves modifying the engine’s actuators to increase the performance near 
idle speeds, a control solution known as high speed idle; this has been shown to decrease the time to reach full power. 6 

Past studies have investigated the ability to improve engine performance during emergency scenarios by altering 
the control algorithm and intelligently reducing the safety limits. 2,3,7 In these studies, the risk of an engine failure is 
assumed to be dependent on the engine’s rotor speeds, pressures, and temperatures. Therefore, the engine limits 
(speeds, pressures, and temperatures) can be raised to higher levels based on the level of risk that is deemed acceptable 
during an emergency situation, resulting either in additional steady-state (overthrust) or transient (faster engine 
response) performance. A risk boundary concept has been proposed, where the engine parameters that correspond to 
a predetermined maximum risk of failure are determined off-line. 3 The pilot/airframe can then request the desired 
thrust up to this predetermined risk level. 

The goal of model based engine control (MB EC) is to provide tighter control of critical unmeasured gas path 
parameters, through advanced estimation techniques, and to improve the overall performance of the gas turbine. 8 
Currently, commercial aircraft engines are designed to meet cautious end-of-life safety margins regulated by the 
Federal Aviation Administration. These safety margins limit engine parameters, both measured and unmeasured, such 
as rotational speeds, temperatures, pressures, and stall margins, which sets specific risks for various types of engine 
component failures. MBEC will allow for operation of the engine with less -conservative margins, as an on-board 
model can provide a more accurate margin estimate at the actual condition of the engine. Rather than operate under 
a margin designed for end-of-life, as currently done, a limit based on this estimated engine condition may be used, 
improving performance, especially in a new engine. For example, a surge margin limiter can be developed to ensure 
that a lower surge margin threshold can be used during transient changes, resulting in a faster response. 

The approach proposed here relies on the integration of the MBEC architecture with the risk boundary concept to 
safely provide an enhanced engine response during an emergency scenario, through a simple and intuitive closed-loop 
control solution. The complex schemes currently used for assessing the risk and changing the controller during an 
emergency scenario can be replaced with designs which take advantage of the estimated parameters of interest, 
provided by an on-board model, and directly use them in the control logic. 

As was done previously, the Commercial Modular Aero -Propulsion System Simulation 40,000 (CMAPSS40k) 9,10 
will be used as the baseline commercial-type turbofan engine simulation for investigating methods of achieving 
additional engine performance. Advanced control algorithms considered in previous studies have included sliding 
mode controllers 11 and Ll adaptive control theory, 12 with attempts to minimize changes in the traditional engine 
control architecture. This paper builds on the previous MBEC work performed by the authors. Section II discusses 
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the MBEC architecture while Section III discusses the implementation of MB EC with a newer version of CMAPSS40k 
than the previous MBEC work. Section IV discusses changes made to MBEC controller for the emergency situations, 
which are mainly related to the limiters in the protection logic; simulation results of the MBEC system with enhanced 
performance are shown in Section V and summarized in Section VI. 

II. The Model-Based Approach 

Traditional commercial aircraft engine control architectures rely on measured data to provide the aircraft with the 
requested power (thrust) and ensure the engine does not exceed any of its physical (pressures, temperatures, rotor 
speeds) or operational (surge margin) limits. Some key engine parameters are not measured, such as thrust, high- 
pressure turbine inlet temperature, and compressor surge margin, so representative parameters are used instead. For 
example, since thrust is not measured in flight, current commercial aircraft engines regulate the fan speed (Nf) or 
engine pressure ratio ( EPR ), both of which have a direct relationship with thrust. 13,9 Similarly, since surge margin is 
not measurable, to avoid a high-pressure compressor (HPC) surge, an acceleration limiter is implemented to limit the 
acceleration of the core, or high-pressure, spool or the ratio of fuel flow (Wf) to combustor static pressure ( Ps3 ), 
commonly noted at Wf/Ps3. As the engine degrades, the assumed relationship between the controlled engine outputs 
and the unmeasured engine parameters tends to break down, leading to degraded performance and operability. 

MBEC relies on an on-board engine model, which can provide a more accurate estimate of the desired engine 
parameters and potentially increase the performance of the engine. Improved estimation of thrust allows the engine 
to deliver more consistent power based on the throttle setting. Replacing the current techniques for limiting 
acceleration with a controller regulating the estimated surge margin can impact the dynamic response of the engine 
for large accelerations. Estimating the surge margin and other operating margins with relative accuracy has an 
additional benefit in that the amount of margin required to ensure that the limit is not violated during worst case 
conditions may be decreased. 

The MBEC architecture is comprised of three main components, as illustrated in Figure 1 : an engine, or “truth,” 
model, an on-board model design to provide real-time estimates of desired unmeasured parameters, and a controller 
with limit protection logic. The individual controllers are designed as simple proportional integral (PI) controllers, 
which is consistent with traditional control architectures. The protection logic uses a minimum (min)/maximum 
(max) selector to provide an appropriate fuel flow command to the actuator. For the simulation study presented in 
this paper, CMAPSS40k 9 will serve as the engine model, an optimal tuner Kalman Filter (OTKF) 14 will serve as the 
on-board model providing estimates of thrust, high pressure turbine inlet temperature, and stall margin, and the 
controller is modified from the standard controller in CMAPSS40k to use the estimated measurements. 
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Figure 1 MBEC Control Architecture. The thrust controller, T40 Limiter, and SM Limiter all rely on 
estimated measurements generated from the Optimal Tuner Kalman Filter. 
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III. Implementation of MBEC to CMAPSS40k Simulation 

CMAPSS40k is a nonlinear, physics -based, component-level dynamic engine model with a realistic closed-loop 
controller written in the MATLAB/Simulink environment. 9,10 CMAPSS40k models a 40,000-pound thrust class, high- 
bypass, dual-spool turbofan engine. The low-pressure components (fan, compressor (LPC), and turbine (LPT)) are 
connected by the fan shaft, and the high-pressure components (HPC and turbine (HPT)) are connected by the core 
shaft (which rotates at a speed Nc ). The fan, compressors, and turbines are modeled using performance maps that 
relate the pressure ratio, mass flow rate, and corrected speed for each component. CMAPSS40k also contains 
scheduled variable stator vanes ( VSV) and a variable bleed valve ( VBV ). The engine model includes a typical turbofan 
engine sensor suite, providing measurements of Nf, Nc , the exit pressures and temperatures of the LPC ( P25 and 725) 
and LPT ( P50 and 750), Ps3 , and the exit temperature of the HPC (750). CMAPSS40k allows for modeling 
degradation of the engine following a fleet average profile of engine deterioration. By modifying the efficiency and 
flow capacity health parameter inputs for each component - fan, LPC, HPC, HPT, and LPT - various engine life 
conditions maybe simulated. The traditional control architecture consists of a set point controller, which can regulate 
EPR or Nf, max limiters, and min limiters. 

A simplified block diagram of the traditional closed-loop architecture is shown in Figure 2. The max limiters 
impose constraints on Nf, Nc, Ps3, T50, and include an acceleration schedule to protect against HPC surge. The min 
limiters include Ps3 and a ratio unit (RU) limiter to protect against surge during a deceleration by regulating Wf/Ps3. 
The command to the fuel flow actuator (referred to as Actuator in Figure 2), Wf, is determined by computing the min 
of the max limiters and the set point controller and then the max of the resulting signal and the min limiters. The 
reader is referred to Ref. 10 for more on the standard CMAPSS40k controller. The EPR and Nf controllers utilize a 
gain scheduled PI controller along with integral windup protection. 

The controller used in this study has been improved over that released with CMAPSS40k through the use of a new 
gain scheduling scheme. Instead of using altitude and Mach number to schedule gains, the controller uses ambient 
pressure (Pa) and ram pressure (RamP), the total pressure at the inlet face (P2) divided by Pa. The throttle mapping, 
which relates the power lever angle (PLA) to thrust via EPR or Nf, also has been updated to increase max thrust at sea 
level static (SLS) (0 ft altitude and Mach 0.0) from 34504.9 to 40089.6 pounds-force. Note that, for comparison 
purposes, the thrust schedule for the baseline version was also updated and the model was re-executed using the new 
thrust values. The maximum and minimum limit values were also modified for this newer version, but the original 
limit values were used here since they correspond to known risk levels. 

To implement MBEC, the standard engine control architecture shown in Figure 2 is replaced by the MBEC control 
architecture of Figure l, 10 where the estimated signals produced by the OTKF rely on the standard set of engine 
outputs from the CMAPSS40k engine. (Note that previous MBEC work in Ref. 8 did not include the P25 and T25 
measurements; when used, these measurements increase the accuracy of the estimated parameters.) For this 
application there are 8 sensors and 10 health parameters, which define an underdetermined estimation problem that is 
solvable using the proposed OTKF approach. The on-board model is a piece- wise linear model of CMAPSS40k and 
consists of a steady-state trim model used to create a delta (the difference between the output of the steady-state model 
and the actual feedback), and a state space model. The state space matrices are calculated for 7 altitudes, 9 Mach 
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Figure 2 CMAPSS40k Traditional Control Architecture 
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numbers, and 14 fan speeds, while the trim point model uses a much finer grid (21 altitudes, 18 Mach numbers and 
64 fan speeds). The inputs to the estimation OTKF include Wf, VSV , and VBV. The estimated parameters from the 
OTKF are the combustor exit temperature ( T40 ), thrust ( Fnet ), HPC SM, LPC SM , HPC flow ( Whpc . ), and the pressure 
ratio across the HPC ( PRhpc ). The latter parameters, Whpc and PRhpc , will be used to improve the estimation of the 
HPC surge margin, especially during engine transients. The nonlinear equation for these estimations is: 

PR S urae(W H pc)dVSV(ySV,Nc) - PR hpc 

HPC SM = — 9 — xlOO (1) 

PRhpc 

where dVSV is the difference between VSV input and the ideal VSV angle, which is a function of VSV and Nc. 

The standard EPR/Nf controller is replaced with a thrust controller, which regulates the estimated thrust from the 
OTKF. This controller is a gain scheduled PI controller with integral windup protection and has the control law: 

u = Kp Fc Kp Fnt e + J Ki Fc Ki Fnt ( e - IWP(hu wf )) (2) 

where Kp Fc and Ki Fc are gains scheduled on the actual RamP and Pa , Kp Fnt and Ki Fnt are gains scheduled on the 
feedback values of Pa and Fnet , and e is the tracking error of Fnet. Integral windup compensation includes a gain, 
IWP, and Auw/is the difference between the fuel flow from the thrust controller and the fuel flow to the engine, as 
determined at the previous time step; this is the same approach used by CMAPSS40k. The PI controllers were 
scheduled to meet a bandwidth of 0.75 Hz and phase margin of 60 degrees at 9 ambient pressures, 5 ram pressures, 
and 12 thrust values ranging from 4,000 lbf to 40,000 lbf. 

Other modifications to the control system were required for MB EC to work correctly. A set point function was 
created to convert the current throttle position to the demanded thrust. The relationship between throttle position and 
thrust is defined at five different RamP (0.9995, 1.0280, 1.1 163, 1.2752, and 1.5240). At each RamP , several altitudes 
(or ambient pressures) were used to verify this relationship and remove any outlier data points. The acceleration 
limiter was modified to regulate the surge margin estimate instead of limiting the core acceleration based on the 
corrected core speed. The surge margin limiter consists of a gain scheduled PI controller, with integral windup 
protection. The T50 limiter was replaced with a T40 limiter, which also includes a PI controller with integral windup 
protection. 


IV. Implementation for Emergency Control Work 

MB EC has previously been investigated as a means to increase the fuel efficiency of a high bypass turbofan engine. 
This paper intends to demonstrate that the MB EC concept has additional benefit regarding the enhancement of the 
engine performance during emergency flight scenarios. The proposed control modes of interest are in response to two 
emergency flight scenarios: i) overthrust control mode for a runway incursion scenario, and ii) faster engine response 
for a rudder/tail failure. These control modes are discussed below in more detail. 

A. Overthrust 

The overthrust control mode was designed in response to a runway incursion-type event, where the available 
takeoff distance is suddenly decreased. In this event, additional thrust produced from the engine can help the aircraft 
reach its safe takeoff speed over a shorter distance, potentially avoiding the disaster. For the engine to produce this 
additional thrust, it must operate at elevated pressures, temperatures, rotor speeds, and, consequently, an elevated risk 
of engine failure. Some of the research regarding overthrust has addressed the evaluation of risks associated with 
implementing and operating at these performance levels 7 , the development of a risk management architecture to extend 
engine limits based on assessment of the emergency severity 2 , and evaluating the change in risk and performance. 3,6 

One solution to the overthrust problem includes defining, off-line, values for the engine parameters that correspond 
to a predetermined maximum risk of failure, extending all the engine limiters to that value, and allowing the 
pilot/airframe to request the desired thrust up to this point. 3 The maximum allowable probability of an engine failure 
accounts for various failures, such as turbine blade failure or rotor disk failure, and is determined by analyzing the 
rotor speeds and turbine temperatures using an available MATLAB® / Simulink® based tool. 7 The main result of 
this approach is calculation of a boundary function representing a constant level of failure probability. Here, this risk 
function operates on five inputs (Nf, Nc, T40 , HPT exit temperature ( T48 ), and T50), defining a five-dimensional 
surface on which the probability of failure remains constant. 

To simplify implementation of this approach, the risk function was analyzed by looking at disk failure and blade 
failures separately to determine if the number of inputs could be reduced. It was found that the risk was sensitive to 
Nc but not Nf; therefore Nf could be removed without significant impact. Because the failure rate was sensitive to 
all three of the temperatures, a linear least-squares fit was developed that correlated T40 to T50, T40 to T48 , and T48 
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to T50 , allowing the three temperatures to be expressed as a single value. With a good correlation between these 
temperatures, a single temperature limit could be constructed. 

An example application of this predesigned risk boundary concept is provided in Ref. 3 through simulation of 
CMAPSS40k at various takeoff conditions. It was determined that the CMAPSS40k engine operates nominally with 
an engine failure rate between 10' 7 and 10' 5 . Data was gathered to determine the acceptable engine limits 
corresponding to a failure rate of 10' 3 . The engine controller was modified by replacing the T50 limiter with the T40 
limiter and the acceleration schedule with a surge margin controller, and adding logic that allows the engine to operate 
at the elevated risk and power levels. 

In this paper, the risk boundary approach is integrated with MB EC as shown in Figure 3. For the enhanced engine 
controller (EEC), the PLA input is converted to a Power Code (PC) variable that ranges from 0 to 100 in normal 
operation or 0 to 110 during an emergency. For a PC from 0 to 100, the fuel flow signal is determined based on the 
thrust controller and standard limiters, with the exception of the appropriate temperature limiter; a limiter on T50 was 
used for the standard controller and one on T40 for MB EC. For a PC from 100 to 1 10, the fuel flow signal is combined 
with the amount of fuel flow required to reach the 10' 3 risk level based on the elevated temperature and Nc limits. 
Note that in Ref. 3 there is discussion regarding how the Ps3 limiter affects the performance during enhanced 
operation, along with results from simulations with and without the Ps3 limiter. For this paper, all the results assume 
that the Ps3 limiter is disabled since the effect of enabling this limit is the same for MB EC. 

B. Faster Engine Response 

The faster engine response control mode is designed to respond to a rudder/tail failure flight scenario in which 
there is a problem with the flight control surfaces. The primary purpose is to increase the dynamic response of the 
engine. As previously mentioned, there have been several attempts at increasing the responsiveness of the engine, 
which share some common features. 2,3 Each attempt has considered increasing the bandwidth of the EPR or Nf 
controller to allow the engine to respond faster to the throttle command, mainly for small transients where no limiters 
are activated. Another common feature is modification of the acceleration schedule, or acceleration limiter, to allow 
the engine to respond faster to large throttle transients by allowing the HPC to operate closer to the surge line. (In an 
emergency scenario, this reduction in the surge margin limit may be acceptable.) The difference between each method 
is in how the acceleration schedule is modified. One method uses a lookup table model to determine the offset added 
to the schedule based on the amount of risk deemed acceptable at the current time. 2 This method is difficult to 
implement as the lookup table model required for high accuracy is quite large, especially when accounting for different 
levels of risk. Another method determines the surge margin limits that correlate to a specific risk, similar to the 
overthrust procedures. This method provides much more consistent results and is easier to implement. 3 

The success of all these methods relies on the ability to estimate the current engine health, or life, without the use 
of an on-board model, and the assumption that the engine will degrade similar to the fleet average. The integrated 
OTKF and MB EC approach offers the advantage of estimating the engine health in real-time and providing a surge 
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Figure 3 EEC architecture. Lightly shaded blocks are modifications from the standard control 
architecture. Note that feedback paths were removed for simplification. 
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margin estimate based on current engine parameters. To request additional performance in the MBEC architecture, 
the surge margin limit would simply be reduced to a value determined from an off-line risk assessment similar to the 
method shown by Liu, et.al. 3 The surge margin limiter would allow the estimate to reach the newly specified surge 
margin limit. 


V. Results 

The MBEC architecture, shown in Figure 1, is implemented with CMAPSS40k. A simulation study is conducted 
comparing the nominal MBEC (no engine enhancements) configuration to CMAPSS40k using a chop and burst 
throttle input at both takeoff and cruise conditions. This particular throttle profile provides the information necessary 
to evaluate both the accuracy of each method and the transient performance. Accuracy is evaluated by the ability of 
the closed-loop controller to deliver the requested thrust, while the transient performance is evaluated through the 
relationship between the response time, or settling time, and minimum HPC SM. 

Figure 4 compares the thrust (top) and EPR (bottom) produced from the engine using the standard CMAPSS40k 
controller and the MBEC architecture. While both controllers drive EPR to the demand, the MBEC is better at 
achieving the requested thrust. The difference between the CMAPSS40k thrust output and the demanded thrust 
indicates the difficulty in modeling the relationship between EPR and thrust. The difference between the MBEC thrust 
output and thrust demand demonstrates the accuracy of the OTKF and linear model and suggests that the tracking 
error can be attributed to modeling errors, slight biases in the engine outputs used to create the estimate, etc. The 
results show one advantage of the MBEC architecture: with an accurate estimate of thrust, the MBEC controller can 
drive the actual thrust of the engine closer to the intended demanded thrust than with a controller tracking either EPR 
or Nf. 

A similar simulation study using a chop and burst throttle profile (like that shown in Figure 4) is also performed 
to test the dynamic performance and steady-state accuracy of the MBEC approach. This study considers the transitions 
between 500 random takeoff and 500 random cruise conditions. Takeoff conditions are defined on an altitude range 
of 0 to 5,500 ft and from 0.0 to 0.25 Mach. The throttle profile transitions from a climb/takeoff setting ( PEA 72 to 
80) to idle {PEA 44 to 48) and back to takeoff {PEA 76-80). Cruise conditions are within a range of 18,000 to 36,000 
feet and 0.4 to 0.8 Mach. The throttle profile transitions from cruise/climb setting {PEA 68-76) to flight idle {PEA 46- 
50), and back to cruise (68-74). Any steady-state operating point at which any steady-state limiter (such as max Nc , 
min Ps3, etc.) is active, for either controller, will be omitted since the error between the thrust produced and demanded 
is due to an engine limitation rather than system (modeling) error. The overall steady- state accuracy for both takeoff 
and cruise are shown in Table 1. Of interest is the number of tests in which the steady-state thrust is within +100 lbf 
and +250 lbf of the actual commanded thrust. At takeoff, the MBEC controller can drive the engine to the desired 
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Figure 4 Comparison between the standard CMAPSS40k controller and MBEC at an altitude of 885.6ft 
and 0.1081 Mach. The top plot compares the thrust response compares the demanded and the bottom 
compares EPR. 
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thrust value, to within ±1001bf, in 
99.4% of the tested conditions. 

Compared to the traditional approach 
(11.3% of the time), this is a great 
improvement. 

From the burst portion of the 
throttle profile, the dynamic 
performance of the closed-loop system 
is determined and compared in Table 2. 

The CMAPSS40k controller relies on 
an acceleration schedule to protect the 
compressor from reaching/exceeding 
the surge line, which limits the core 
acceleration and is developed off-line for an average engine. Therefore, some engines will be more likely to surge 
while other engines are more capable of achieving better performance. The engines that are capable of achieving 
better performance are limited due to the overly conservative limiter required for those engines that perform worse 
than average. The MBEC approach relies on directly limiting surge margin based on an estimated value, which can 
allow all engines to reach to a predetermined limit, maximizing performance. 

Figure 5 shows how the 
relationship between the 
settling time and minimum 
HPC surge margin varies at 
each test case for an engine 
controlled with the standard 
CMAPSS40k controller and 
MBEC. For takeoff 
conditions, the goal is to be 
able to transition from an 
idle setting to a takeoff 
setting in less than 5 seconds, 

which meets Federal Aviation Administration transient requirements. 15 The surge margin controllers are designed 
for a minimum surge margin of 12%. The results demonstrate that MBEC provides a more consistent settling time 
across the profiles considered, with a less-consistent minimum surge margin. For CMAPSS40k, 42.5% of the test 
cases had a settling time greater than 5 seconds, and 9.5% with a surge margin less than 12%. For MBEC, 10.20% of 
the accelerations took longer than 5 seconds and 10.20% had a surge margin less than 12%. The MBEC surge margin 
controller was tuned at only a few different conditions for a throttle step change to meet the 5 second thrust transient 


Table 2 Comparison of the average dynamic performance for the 
CMAPSS40k baseline control and MBEC for 500 random takeoff flight 


conditions. 



CMAPSS40k 

MBEC 

Rise Time (s) 

2.920 

2.127 

Rise Time Standard Deviation (s) 

0.3027 

0.1720 

Settling Time (s) 

5.392 

5.008 

Min Surge Margin (%) 

13.51 

14.11 

Min Surge Margin Standard Deviation (%) 

1.0734 

1.6132 


Table 1 Comparison of the percent of test cases in which the 
CMAPSS40k baseline control and MBEC models achieved the 
requested thrust, within the specified range. 



Thrust Range 
dbf) 

CMAPSS40k 

(%) 

MBEC 

(%) 

Takeoff 

±250 

32.50 

100 

+100 

11.27 

99.38 

Cruise 

+250 

91.78 

100.00 

+100 

44.82 

99.86 



Figure 5. Comparison of the relationship between the settling time and minimum surge margin for 
CMAPSS40k and MBEC controlled engines. 
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requirement and preserve a particular surge margin (12%). Higher fidelity surge margin models, more complex surge 
margin controllers, and tuning at additional flight conditions could improve the performance of the controller. 

A. Overthrust 

Previous work 3 described the concept of a risk-based control mode intended to increase maximum engine thrust 
during an emergency scenario (e.g., runway incursion). When active, the so-called overthrust control mode increases 
thrust output until the calculated failure probability reaches a preset value (in this case, 10' 3 failures per flight hour). 
Unfortunately, the sensor suite within CMAPSS40k does not include T40 or T48 , so the previous work designed the 
control mode to use T50 data to infer T40 and T48 values; when tested at different operating conditions, this resulted 
in a spread of the risk values around the desired 10' 3 threshold. 

The MB EC controller is modified to resemble the architecture for enhanced engine performance 3 as shown in 
Figure 3 and tested to demonstrate the advantage of MBEC, particularly for emergency scenarios. Instead of using 
the measured T50 values, the estimated values of T40 from the MBEC architecture are utilized. (Recall that the MBEC 
architecture developed in this work uses a newer version of CMAPSS40k than the enhanced engine performance 
work.) In an attempt to account for the different power management controllers, the engine limiter values found in 
the previous version of CMAPSS40k will be used for max Nf, max Nc , and max Ps3. The T50 max will be set to 
1490°R, which was assumed in the baseline risk calculations. These two overthrust methods, using measured T50 or 
estimated T40 values, were tested at 200 random low-altitude (0-5500 feet), low-Mach number (0-0.25) conditions, 
spanning the full life-cycle of the engine (50-hour to end-of-life). Note that the case number is consistent throughout, 
however the flights are not numbered in a meaningful fashion. Although Figure 6 shows that both methods produce 
similar percent increases in maximum thrust, with the use of the traditional T50 sensor performing slightly better, the 
results in Figure 7 and Figure 8 demonstrate the clear advantages of using MBEC. 

Figure 7 plots the failure probability for the 200 test cases when the engine operates at baseline maximum thrust, 
with overthrust using T50 sensor, and with overthrust using MBEC (estimated T40). As expected, the baseline risk 
remains below the FAA-dictated allowable failure probability of 10" 5 per flight hour in 99.5% of the tests cases. Using 
the T50 sensor, the failure probabilities are not constrained to the elevated 10' 3 level and exhibit a relatively large 
spread. The risk function is highly sensitive to the hotter HPT temperatures, and the correlation dataset used to infer 
T48 and T40 from T50 is insufficient. On the other hand, using MBEC allows for the direct use of T40 in the overthrust 
control algorithms, producing results tightly grouped around 10' 3 . 
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Figure 6 Net thrust improvements with MBEC and enhanced engine operation control architecture 
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Figure 7 Calculated failure probability for 200 random cases operating at baseline maximum thrust, 
overthrust using the T50 sensor measurement to limit risk, and overthrust using the T40 measurement 
available with MBEC to limit risk. 


Figure 8 reiterates these results in a different format. Here, the 10' 3 risk level is plotted as the two-dimensional 
locus of allowable core speed and T40 values. As the figure shows, MBEC enables the overthrust mode to accurately 
and precisely push the engine to the desired risk level, whereas using the T50 sensor measurements produces results 
that exceed the established risk boundary. 
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B. Faster Engine Response 

Previously-proposed controller modifications for the faster engine response control mode required retuning the 
EPR controller to increase the bandwidth and changing the acceleration schedule to allow the HPC to operate closer 
to the surge line. Additional modifications, to establish an operating mode referred to as high-speed idle, included 
changing the variable stator vanes and controller bandwidth to increase the fan speed while holding idle thrust 
constant, decreasing the efficiency of the engine, but allowing faster spool ups. The previous faster engine response 
work and risk analysis assumed a surge margin that represented the surge margin remaining after debits, such as tip 
clearance, deterioration, etc., were accounted for. Estimation of this signal is difficult because many of these debits 
are very nonlinear. Instead, the system here is designed to regulate the surge margin based on corrected flow and 
pressure ratio, without accounting for other debits. 
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Figure 9 Relationship between rise time and minimum HPC SM for the baseline controller (CMAPSS40k) 
and MBEC with a reduced surge margin for emergency scenarios. 


For the MBEC controller, the EEC incorporates two modification: a decrease in the surge margin limit and a slight 
increase in the controller bandwidth. In this example, the HPC SM value is changed to 7% (from 12%), which 
approximates the same overall level of risk reported in Ref. 3. Figure 9 compares the relationship between the rise 
time and minimum surge margin for both the baseline engine and MBEC with a reduced HPC SM for emergency 
scenarios at the 200 test flight conditions. 

Figure 9 shows that the surge margin controller allows the engine to operate at a slightly lower minimum surge 
margin (approximately 4.5%) than intended (7%) and produces a reduction in rise time, from 2.85- 3.05 seconds to 
1.7-2. 1 seconds. The error in the minimum surge margin can be attributed to both the accuracy of the estimated surge 
margin and the controller itself. These results could be improved by implementing more advanced controllers, or 
tuning the surge margin controller at more operating points. 


C. Discussion 

The MBEC architecture implemented in this work is an upgraded version of a previously-implemented MBEC 
architecture. 8 This MBEC featured a full envelope thrust controller, full envelope surge margin controller, and a 
high-pressure turbine inlet temperature controller. The OTKF used here adds two inputs, P25 and 725, to that in the 
previous work, which increases the accuracy of the on-board model and OTKF. This was shown, through simulation 
of throttle transients at 500 random takeoff conditions and 500 random cruise conditions, to be within +100 lb thrust 
for over 99% of the tested conditions. 

The MBEC architecture was modified to include an EEC that improves the capability of the engine through the 
generation of additional thrust, referred to as the overthrust control mode, or by allowing the engine to respond faster 
to the throttle command, referred to as faster engine response. For the overthrust control mode, to allow the engine to 
operate to higher power levels than originally designed for, the EEC modifies the set point command to allow the pilot 
to request up to 1 10% of the nominal thrust. Compared to previous emergency scenario work, the MBEC architecture 
offers two main improvements over the traditional engine controller when in the overthrust control mode. First, 
instead of extending and tracking the EPR of Nf commands, the thrust command range is increased and regulated. 
Second, instead of modeling the relationship between the high-pressure turbine inlet pressure and exhaust gas 
temperature, which is used to limit the risk, MBEC allows for the estimate of the HPT inlet temperature to be a 
feedback variable, which produced more accurate results than using the exhaust gas temperature. 

The faster engine response control mode increases the performance of the engine by allowing it to respond more 
quickly to the throttle command. The main factor of concern in this control mode is compressor surge. Current 
techniques for protecting against compressor surge include regulating the corrected core acceleration, or the ratio of 
the fuel flow to combustor static discharge pressure. Both of these limiters are designed using a worst-case scenario, 
such as an end-of-life engine, which severely constrains the performance of newer engines. The MBEC architecture 
applied here estimates the surge margin, which allows newer engines to respond even faster and reach a lower surge 
margin during transient operation. 
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VI. Summary 

This paper applies a model-based engine control (MB EC) architecture to the Commercial Modular 
Aero-Propulsion System Simulation 40,000 (CMAPSS40k) and demonstrates the advantage of using MBEC during 
emergency operation. This MBEC implementation contains an optimal tuner Kalman Filter (OTKF), which provides 
estimates of key unmeasured engine parameters, such as thrust, high-pressure turbine inlet temperature, and surge 
margin. Estimation of these parameters can impact the control system in several ways. The controller can deliver 
more consistent power to the airframe by estimating and directly regulating thrust. The control system can better 
avoid exceeding a critical physical limit which could severely decrease engine life, such as that imposed on the 
high-pressure turbine inlet temperature. By regulating an accurate estimate of the surge margin, the amount of extra 
margin required to be carried can be decreased. During an emergency flight scenario, sensed engine limits may be 
modified to allow the engine to perform better at an elevated risk of failure and to increase the overall safety of the 
aircraft. With the MBEC architecture, key engine limits that are not measured can be modified and directly used as 
feedback to the controller. Regulating these key engine parameters directly allows for better control over the amount 
of risk the engine is allowed to operate at and produces better performance for the assumed risk level. 
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